Shutdown Strains Healthcare Cyber Defenses

If it lasts much longer, the federal government shutdown could prove to be highly disruptive, risky and increasingly unnerving for healthcare sector providers that depend upon federal agencies for cybersecurity-related support and resources, some experts said.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center, worries that adversaries could take advantage of the shutdown by launching “high impact cyber incidents causing prolonged disruptions in the health sector, ultimately impacting patient safety and the ability to provide life-saving services.”

“When there’s a disruption like this, human lives are at stake,” Weiss said. “Health-ISAC has been tracking ransomware incidents since 2020. For 2025, we’re going to witness a record-breaking number of ransomware attacks.”

The shutdown follows workforce reductions earlier this year at key federal agencies, including the U.S. Department of Health and Human Services and the Cybersecurity Infrastructure and Security Agency.

HHS on its contingency planning website said that more than 59% of HHS employees will be retained during the shutdown while 41% are furloughed. “These percentages vary among HHS operating divisions and offices. Operating divisions with a substantial direct service component will have more of their staff retained,” HHS said.

HHS said two types of staffers are still working: roles that are authorized by law and those that support the “safety of human life and protection of property, consistent with Department of Justice legal opinions.”

The HHS Office for Civil Rights, which administers and enforces HIPAA and is part of HHS’ Office of the Secretary, is continuing with its HIPAA-related investigations during the shutdown, according to HHS on its contingency planning webpage for its OS.

But that doesn’t necessarily mean HHS OCR will be able to keep up with its volume of investigatory work, or have the staff to carry out other HIPAA-related work, such as rulemaking, guidance and technical assistance to covered organizations and business associates during the shutdown, experts said.

“I expect that the government shutdown will delay the resolution of those investigations or audits,” said privacy attorney Adam Greene of the law firm David Wright Tremaine.

The shutdown will undoubtedly slow down key rulemaking work as well, he said. “In HHS’s most recent regulatory agenda, it indicated an intent to finalize the 2021 proposed changes to the Privacy Rule and 2025 proposed changes to the Security Rule in May 2026,” he said. “I expect that the shutdown, if it lasts for a while, will delay these timelines – which always were aspirational at best anyway,” he said.

According to HHS’s contingency staffing plan, “only staff considered ‘mission critical’ stay on during a shutdown. That means the urgent, life-and-death work continues – like responding to major breaches that could directly threaten patient care or handling emergencies that touch public health and safety,” said Jackie Mattingly, senior director of consulting services at healthcare privacy and security consultancy Clearwater.

“Those activities are protected. But other important areas slow down or pause. That includes long-term HIPAA audits, lower-priority investigations, proactive compliance reviews and grant-supported cybersecurity projects,” said Mattingly, a former longtime healthcare CISO.

“These don’t meet the ‘life and property’ threshold, so they’re delayed until funding returns. Cybersecurity staff who aren’t tied to immediate incident response are also furloughed, which can stall proactive guidance, training and interagency coordination.”

Other OS agency activities that will continue during the shutdown include the Office of Inspector General’s Health Care Fraud and Abuse Control Program and funded oversight activities, and the Office of Medicare Hearings and Appeals case adjudication, HHS said.

Other Agencies Affected

But besides HHS, the government shutdown also greatly hinders other critical federal agencies that provide important help in supporting the healthcare sector in its cybersecurity efforts.

“From my perspective, the most disruptive impact of the shutdown is the loss of coordinated, trusted awareness at the very moment when threats are multiplying,” Mattingly said.

“Just in the past few weeks, we’ve seen critical vulnerabilities disclosed in Cisco, SonicWall and Citrix products – technologies that sit at the heart of hospital networks. When these flaws emerge, they often come with active exploitation already underway,” she said.

“That’s where CISA adds unique value for the healthcare sector,” she said. CISA just doesn’t point to a vendor patch, “they provide indicators of compromise, detection rules and practical mitigations that help hospitals confirm whether they’ve been targeted and take defensive action quickly.”

CISA also issues industrial control system advisories when vulnerabilities touch broader infrastructure – such as power, HVAC or OT environments that healthcare facilities depend on to keep operations stable, she said. “Each hospital only sees its own traffic and environment, but CISA aggregates data from across sectors, connects the dots and pushes out actionable intelligence. That coordination gives hospitals the ability to defend faster than they ever could working alone.”

As of May 31, CISA had 2,540 employees, according to Department of Homeland Security contingency planning documents. CISA estimates that only about 35% – or 889 of those employees – will be retained during a lapse in appropriation, according to DHS.

High Anxiety

Indeed, the slowdown in federal warnings and shutdown of federal services will leave many healthcare sector entities – especially smaller ones – exposed to cyberattacks, said Health ISAC’s Weiss. “Smaller hospitals and clinics often rely on free federal resources like CISA’s Cyber Hygiene scanning service. These organizations lack the extensive in-house cyber staff and budget of larger hospital systems,” he said.

Medical device manufacturers and health IT providers are also at risk, as they also depend on federal agencies for regulatory guidance and vulnerability disclosures, he said. “Delays can leave critical vulnerabilities unpatched, increasing the risk of exploitation.”

Real-time threat intelligence and coordination will be hampered as a result of the shutdown, said Lee Kim, senior principal of cybersecurity and privacy at the Healthcare Information and Management Systems Society.

“Situational awareness is everything in cybersecurity,” she said. To fill the gaps left by the shutdown, “healthcare organizations should reach out to their vendors for threat intelligence and support, the Health ISAC or their information sharing and analysis organizations, and other resources in their community – such as associations and colleagues,” she advised.

While federal agencies may scale back operations, the Health ISAC continues to provide “uninterrupted support to its members,” Weiss said. “Health-ISAC has always been a cornerstone of resilience for the health sector, and during the shutdown, its role becomes even more critical,” he said.

Nonetheless, the shutdown – and the longer it drags out – is fueling high anxiety among many healthcare sector entities, other experts said.

“There was high level of uncertainty among many in the healthcare sector before the shutdown, and now with the shutdown, it’s even more unnerving – there’s a cloud that’s overlaying everything,” said Mari Savickis, who heads up government relations at the College of Healthcare Information Management Executive, a professional association of healthcare CISOs and CIOs.

“Our members use many of the free tools from CISA. Those tools are still available. But what if something happens or someone has a question. CISA is operating with a skeleton crew and there’s flux,” she said.

Even when the shutdown ends, affected agencies will need time to “fire up again,” and uncertainty about cyber issues affecting the healthcare sector could continue, including whether the CISA Act of 2015 gets renewed, she said.

Ultimately, “now is the time for us to work together as a community to strengthen our security postures and resilience,” said HIMSS’ Kim. “We need to be strong for our patients and the well-being of our nation.”